762f21a26e15ff6be193236b2e90c7a520884853ac8f407f6f92b3386d894aa8

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9dddd29f3cc474a5141336c2ffd75c0N.exe
Size

206KB
MD5

b9dddd29f3cc474a5141336c2ffd75c0
SHA1

8ed739b24f51163b76495b6aeb621132e53af986
SHA256

762f21a26e15ff6be193236b2e90c7a520884853ac8f407f6f92b3386d894aa8
SHA512

45c8b41dc8886e469b4d34976e30b8fbd7f4c4d465aa070cb6bdadcbba2b43e75cedf019404467b8edb7a6328ddd3dcae982d79c1792c5403354bb6617b5a63b
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unB:zvEN2U+T6i5LirrllHy4HUcMQY6E

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
2788	explorer.exe
4140	spoolsv.exe
4320	svchost.exe
2652	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\explorer.exe	b9dddd29f3cc474a5141336c2ffd75c0N.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b9dddd29f3cc474a5141336c2ffd75c0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe
1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe
2788	explorer.exe
2788	explorer.exe
4320	svchost.exe
4320	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2788	explorer.exe
4320	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe
1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe
2788	explorer.exe
2788	explorer.exe
4140	spoolsv.exe
4140	spoolsv.exe
4320	svchost.exe
4320	svchost.exe
2652	spoolsv.exe
2652	spoolsv.exe
2788	explorer.exe
2788	explorer.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2788	1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe	84
PID 1960 wrote to memory of 2788	1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe	84
PID 1960 wrote to memory of 2788	1960	b9dddd29f3cc474a5141336c2ffd75c0N.exe	84
PID 2788 wrote to memory of 4140	2788	explorer.exe	85
PID 2788 wrote to memory of 4140	2788	explorer.exe	85
PID 2788 wrote to memory of 4140	2788	explorer.exe	85
PID 4140 wrote to memory of 4320	4140	spoolsv.exe	87
PID 4140 wrote to memory of 4320	4140	spoolsv.exe	87
PID 4140 wrote to memory of 4320	4140	spoolsv.exe	87
PID 4320 wrote to memory of 2652	4320	svchost.exe	89
PID 4320 wrote to memory of 2652	4320	svchost.exe	89
PID 4320 wrote to memory of 2652	4320	svchost.exe	89
PID 4320 wrote to memory of 1132	4320	svchost.exe	90
PID 4320 wrote to memory of 1132	4320	svchost.exe	90
PID 4320 wrote to memory of 1132	4320	svchost.exe	90
PID 4320 wrote to memory of 1704	4320	svchost.exe	101
PID 4320 wrote to memory of 1704	4320	svchost.exe	101
PID 4320 wrote to memory of 1704	4320	svchost.exe	101

C:\Users\Admin\AppData\Local\Temp\b9dddd29f3cc474a5141336c2ffd75c0N.exe
"C:\Users\Admin\AppData\Local\Temp\b9dddd29f3cc474a5141336c2ffd75c0N.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2788
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4320
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2652
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:50 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1132
    - - C:\Windows\SysWOW64\at.exe
        
        at 06:51 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
206KB

MD5
36f056a2b25b783681eb17779b28c840

SHA1
ac02e8cf3975a2462ca50c45835f7b233972aef2

SHA256
06844473702071527a4bd1fad8e695df439725bf7d1ffd1e908c92dd15ef8b88

SHA512
e5372664c65482f0b02561e17d98f77e2ab8488388dffe37965040c5fef603b169cac3fa75e0529b148692e9551d6d9216fa40d430c45aa9afad68a33ef7a7ea

Download Submit
C:\Windows\System\explorer.exe

Filesize
206KB

MD5
ff97871d4588032df0efa0ef90f317a7

SHA1
1056e4ce1e83e8ab5fd8c595b30e7b4dd34b76a0

SHA256
83226252f10041617a8cd28be898983fed9d1e9e8c61691d6dec7783a0ed316e

SHA512
fe958bd00266e163aecce2e6ad5c98ed53d95cdcc0dad16d197867d982de3ddd637d0021bd86235066e76afeb1e0fae2fb22b6841de8dfb1b12780838f3e3536

Download Submit
C:\Windows\System\spoolsv.exe

Filesize
206KB

MD5
af92425e863dfa55eb3c0e58bd9fa053

SHA1
a18d47bbe53e75385b95dbb197c2ed08b2005a77

SHA256
b72853414d4858502cade770ef7e21186e66e13342102d316ebaa0f90fdc5d37

SHA512
cb403609b461b02ce74fc16d2701c68576e1a91ea6d819ef9ea075473fc8795a5fa8a26a4e04f75614037d9a24c6acc0e8a35311fbcf541335607922989b191a

Download Submit
C:\Windows\System\svchost.exe

Filesize
207KB

MD5
ed22f02cb4dbb1c724f737e34ff9a5c5

SHA1
fe8d3ccd9b4cfcae5e7e5452c22697ab035304f9

SHA256
5391d55a67aa7e4dfa8c23b8df1ddb5a3ffbfe126a534b65910a11a10fed38ae

SHA512
52f57c6c3fd1fe6fcbdf223607dda62a089658f6b7e450d739e24cd8169b55f3a975da014489ce1c6fffeb46dc76e07787d10c995006a1c342fc1f4a8722afca

Download Submit